Assigning subnet filters to event handlers

You can streamline SOC processes by defining a subnet whitelist/blacklist for event handlers. These addresses can be linked to any event handler to enable or prevent it from triggering an event. Creating a subnet whitelist/blacklist for event handlers eliminates the need to specify common networks in every event handler.

To include or exclude subnets in an event handler:

1. Go to FortiSoC/Incidents & Events > Handlers > Event Handler List.
2. Select an event handler to edit from the list.
3. In the Subnets category, select Specify.
4. Choose which subnets to include or exclude by selecting them from the corresponding dropdown menu.

   

5. Select OK.

If a conflict arises between the exclude and include lists, the exclude list will take priority.

Subnet filters work when either SRCIP or DSTIP hit the subnet, meaning SRCIPs and DSTIPs share the same subnet filters.